Summary

Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming
it.

Manual action

Perform a full scan of the computer system with the F-Secure security product to find and disinfect the relevant files. Before scanning, enable the product to
scan system files by following these steps:

In the F-Secure product, go to "Settings"

Go to "Manual scanning"

Uncheck "Scan only known file types"

Then perform a full computer scan.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global
site.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Suspect a file is malicious?

If in doubt, or in cases where a legitimate file is suspected to contain malicious
code, please send a sample to F-Secure Security Labs via the Sample Analysis System (SAS) for analysis. You may want to refer to the following Support articles for more
details:

Technical Details

Rootkit:W32/ZAccess is distributed in programs disguised as a cracked copies of legitimate
commercial software (a distribution method more commonly seen with trojans). It may be distributed via pornography websites. It has also been reported as being
distributed via compromised legitimate websites.

Once installed, ZAccess will display unsolicited advertisments on the machine and
redirects the web browser to unsolicited advertisement websites. In order to do the
latter, the malware may contact remote servers to retrieve additional advertising
information; the specific URLs contacted are varied, but the top level domain is always
.CN.

Installation

On installation, the malware will replace a system driver (in the location %WINDIR%\system32\drivers)
with a copy of its rootkit driver. Selection of a system driver to replace is done
using an internal algorithm. The rootkit will display the contents of the original
system driver, presumably to camouflage its presence on the system.

The malware then creates a hidden, encrypted volume which is used to store the original
system driver file that was replaced, as well as other component files used by the
malware. The hidden volume has the following format:

%WINDIR%\$NtUninstallKB{5_digits}$

It also creates a zero byte Alternate Data Stream file in %WINDIR%\{numbers_only_file}
which will be silently executed and run in the background:

Some variants of this malware will drop other component files in the following location:

%USERPROFILE%\Local Settings\Application Data\number_only_folder

SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis